Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win10v2004-20220812-en
General
-
Target
Trojan-Ransom.Win32.Blocker.fzrc-3db4dbd79dcfed41ba22073a3ca53ee233a9da172fbf8f21efcc400936d2a1da
-
Size
16KB
-
MD5
bae43dfcdf8d16b53b1e49a9945f5e84
-
SHA1
ec56a75ba6fcf6cfecf0cb99f9fcc442cbaae3d7
-
SHA256
3db4dbd79dcfed41ba22073a3ca53ee233a9da172fbf8f21efcc400936d2a1da
-
SHA512
44cdeb8523877cb6cac88109a0fa4c000c9c1d163b4ac88ec02b5ee1c4cc8f0510e60b1dabfcc0695fcd52c974d8501fcb59b198e32b353f5ab800ac6876775d
-
SSDEEP
96:vPa1vcCgksQucL4TyPyrMIBRb5Ptboynu+3r:vqEBcL4gQBbP1oynu+
Malware Config
Signatures
Files
-
Trojan-Ransom.Win32.Blocker.fzrc-3db4dbd79dcfed41ba22073a3ca53ee233a9da172fbf8f21efcc400936d2a1da.exe windows x86
1c9449330c4f03b6524bacba296ae886
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetSpecialFolderPathA
ShellExecuteA
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
_initterm
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
sprintf
strchr
strcat
strcpy
fopen
fprintf
fclose
__p__fmode
kernel32
GetStartupInfoA
GetModuleHandleA
WinExec
CreateFileA
CloseHandle
GetFileTime
SetFileTime
GetWindowsDirectoryA
DeleteFileA
FindFirstFileA
CopyFileA
FindNextFileA
FindClose
GetModuleFileNameA
Sleep
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mqmafzs Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE